Task Manager Cross-Site Scripting Vulnerability

Task Manager is an open source task manager application from Code-Projects. Task Manager v1.0 suffers from a cross-site scripting vulnerability that originates from a cross-site scripting XSS vulnerability in the file /TaskManager/Tasks.php...

Employee Managment System SQL Injection Vulnerability

Employee Managment System is an employee management system. An SQL injection vulnerability exists in Employee Managment System v1.0 that originates from allowing an attacker to bypass authentication by injecting a payload into the /alogin.html parameter...

Employee Managment System SQL Injection Vulnerability

Employee Managment System is an employee management system. An SQL injection vulnerability exists in Employee Managment System v1.0, which originates from a SQL injection vulnerability in the file /delete.php...

jetty: Improper validation of HTTP/1 content-length

A flaw was found in Jetty that permits a plus sign + preceding the content-length value in a HTTP/1 header field, which is non-standard and more permissive than RFC. This issue could allow an attacker to request smuggling in conjunction with a server that does not close connections after 400...

lambda-middleware Security Vulnerabilities

lambda-middleware is a collection of middleware for AWS lambda functions. A security vulnerability exists in dbartholomae lambda-middleware frameguard version 1.0.4 and earlier, which stems from a security vulnerability in the component JSON Mime-Type Handler...

CVE-2024-25315

Code-projects Hotel Managment System 1.0, allows SQL Injection via the 'rid' parameter in Hotel/admin/roombook.php?rid=2...

Event Student Attendance System SQL Injection Vulnerability

Event Student Attendance System is a student event attendance system by the individual developer Remy Andrade. An SQL injection vulnerability exists in Event Student Attendance System version 1.0, which originates from allowing SQL injection via the student parameter...

CVE-2024-25305

Code-projects Simple School Managment System 1.0 allows Authentication Bypass via the username and password parameters at School/index.php...

PT-2024-20424 · Unknown · Employee Management System

Name of the Vulnerable Software and Affected Versions: Employee Management System version 1.0 Description: The issue allows a remote attacker to execute arbitrary SQL commands via the txtfullname and txtphone parameters in the "edit profile.php" component. Recommendations: For Employee Management...

PT-2024-20420 · Unknown · Daily Habit Tracker

Name of the Vulnerable Software and Affected Versions: Daily Habit Tracker version 1.0 Description: The issue allows a remote attacker to execute arbitrary code via a crafted GET request. This is due to a SQL Injection vulnerability in the delete-tracker.php file. Recommendations: For Daily Habit...

Daily Habit Tracker Authorization Issues Vulnerability

Daily Habit Tracker is a daily habit tracker by rems personal developer. Daily Habit Tracker version v.1.0 suffers from an authorization issue vulnerability that stems from allowing an attacker to manipulate the Tracker via components such as delete-tracker.php...

PT-2024-20422 · Unknown · Employee Management System

Name of the Vulnerable Software and Affected Versions: Employee Management System version 1.0 Description: The issue allows a remote attacker to execute arbitrary SQL commands via the txtusername and txtpassword parameters in the "login.php" component. This enables the attacker to manipulate the...

PT-2024-20421 · Unknown · Daily Habit Tracker

Name of the Vulnerable Software and Affected Versions: Daily Habit Tracker version 1.0 Description: An issue in the software allows a remote attacker to manipulate trackers via the "home.php", "add-tracker.php", "delete-tracker.php", "update-tracker.php" components. Recommendations: For Daily Hab...

PT-2024-20423 · Unknown · Employee Management System

Name of the Vulnerable Software and Affected Versions: Employee Management System version 1.0 Description: The issue allows a remote attacker to execute arbitrary code via the "edit-photo.php" component. This is due to an Unrestricted File Upload vulnerability. Recommendations: For Employee...

Restaurant POS System Cross-Site Scripting Vulnerability

Restaurant POS System is a full-featured Restaurant POS System project based on the Restaurant POS System project by Martin Mbithi Nzilani Individual Developer. A cross-site scripting vulnerability exists in Restaurant POS System version 1.0, which stems from the parameter Full Name in the file...

NCR Atleos Terminal Handler Security Vulnerability

NCR Atleos Terminal Handler is an ATM enterprise software solution from NCR Atleos that reduces costs, improves business agility and increases your competitive advantage. A security vulnerability exists in NCR Atleos Terminal Handler version v.1.5.1. A remote attacker could exploit the...

PT-2024-14336

Name of the Vulnerable Software and Affected Versions Stock Management System version 1.0 Description The issue allows a remote attacker to execute arbitrary code via the id parameter in the "manage bo.php" file. This enables the attacker to potentially gain unauthorized access and control over t...

CRUD Without Page Reload/Refresh Cross-Site Scripting Vulnerability

sourcecodester PHP CRUD without Refresh/Reload using Ajax and DataTables Tutorial is an open source project to help people learn how to build or develop a PHP CRUD without Refresh/Reload using Ajax and DataTables. CRUD Without Page Reload/Refresh version 1.0 suffers from a cross-site scripting...

PT-2024-17458

Name of the Vulnerable Software and Affected Versions SourceCodester CRUD without Page Reload version 1.0 Description A vulnerability was found in the file fetch data.php, where the manipulation of the username or city argument leads to cross-site scripting. The attack may be launched remotely...

CVE-2024-24757 open-irs .env Exposure

open-irs is an issue response robot that reponds to issues in the installed repository. The .env file was accidentally uploaded when working with git actions. This problem is fixed in 1.0.1. Discontinuing all sensitive keys and turning into secrets...